[NETFILTER]: Fix conntrack master_ct refcounting.

net/ipv4/netfilter/ip_conntrack_core.c

@@ -305,9 +305,6 @@ destroy_conntrack(struct nf_conntrack *nfct)
 	IP_NF_ASSERT(atomic_read(&nfct->use) == 0);
 	IP_NF_ASSERT(!timer_pending(&ct->timeout));
 
-	if (master_ct(ct))
-		ip_conntrack_put(master_ct(ct));
-
 	/* To make sure we don't get any weird locking issues here:
 	 * destroy_conntrack() MUST NOT be called with a write lock
 	 * to ip_conntrack_lock!!! -HW */
@@ -324,9 +321,12 @@ destroy_conntrack(struct nf_conntrack *nfct)
 
 	/* Delete our master expectation */
 	if (ct->master) {
+		if (ct->master->expectant) {
 			/* can't call __unexpect_related here,
 			 * since it would screw up expect_list */
 			list_del(&ct->master->expected_list);
+			ip_conntrack_put(ct->master->expectant);
+		}
 		kfree(ct->master);
 	}
 	WRITE_UNLOCK(&ip_conntrack_lock);